password_verify使用password_hash错误在登录时将用户存储在会话中

Question

I'm having a issue with password_hash, when i login i want to bring the user logged in Session, but do not work when i use password verify, the ECHO return nothing. How i can solve this? Thanks This is my code:

    <?php
session_start();
include_once("../Backend/conexao_db.php");

if((isset($_POST['txt_usuario'])) && (isset($_POST['txt_senha']))) {
    $usuario = mysqli_real_escape_string($conn, $_POST['txt_usuario']); 
    $pass = mysqli_real_escape_string($conn, $_POST['txt_senha']);
    $passwordhash = password_hash($pass, PASSWORD_DEFAULT);

    $result_usuario = "SELECT * FROM tbl_Usuario WHERE email = '$usuario' && senha = '$pass'";
    $resultado_usuario = mysqli_query($conn, $result_usuario);
    if ($resultado = mysqli_fetch_assoc($resultado_usuario)) {
        if (password_verify($pass, $passwordhash)) {


        $_SESSION['usuarioId'] = $resultado['id'];
        if ($_SESSION['empresaID'] == "") {
            echo $_SESSION['usuarioId'];

            } else {

            }

        }
    }
}

This code work perfectly when i not use password_verify.

Answer 1

What your'e doing there is useless, because you're testing the password hash you just created for matching with itself. This would always be true.

Without knowing your Session-Variables I would guess that if ($_SESSION['empresaID'] == "") is causing your error, unless you set it elsewhere.

But to improve your code:

You should store the hash in the database and test the result for a match with the inputted password. Goal of this procedure is that you don't have to store the password in plaintext in your database.

Also, please use prepared statements to prevent SQL-injection. In my example I used PDO .

With prepared statements you can avoid mysqli_real_escape_string - it would change the password if there are any special characters in it.

if((!empty($_POST['txt_usuario'])) && (!empty($_POST['txt_senha']))) {
  $usuario = $_POST['txt_usuario'];
  $pass = $_POST['txt_senha'];

  // returns a connection to pdo
  $conn = Database::connectPDO();
  $stmt = $conn->prepare('SELECT * FROM tbl_Usuario WHERE email = :email');
  $stmt->bindParam(':email', $usuario);

  if($stmt->execute()) {
    while($user = $stmt->fetch(PDO::FETCH_ASSOC)) {
      if(password_verify($pass, $user['senha'])) {
         echo 'success';
       }
     }
  }
}

So, if you're adding an user, you should store the password hashed in the database for this function to work:

if((!empty($_POST['txt_usuario'])) && (!empty($_POST['txt_senha']))) {
  $usuario = $_POST['txt_usuario'];
  $pass = $_POST['txt_senha'];

  $hashedPassword = password_hash($pass, PASSWORD_DEFAULT);

  $conn = Database::connectPDO();
  $stmt = $conn->prepare('INSERT INTO tbl_Usuario (email, senha) VALUES (:email, : senha)');
  $stmt->bindParam(':email', $usuario);
  $stmt->bindParam(':senha', $hashedPassword);

  if($stmt->execute()) {
    echo 'successfully registered';
  }
}